Re: checking for security issues
Ouch. I wouldn't have that code live if I were you.
PHP 4 and 5 come with Magic Quotes. This will automatically escape all client to server passed variables (GET & POST). However, not all PHP configurations have this turned on. In fact, for PHP 6 it has been deprecated. So, here is what I would suggest doing at the top of every page you process GET or POST variables.
PHP Code:
<?php
if (!get_magic_quotes_gpc()) {
foreach ($_POST as $k => $v) { // you can also change this to $_GET for URL variables
$_POST[$k] = mysql_real_escape_string($v);
}
}
?>
If the post was helpful...Rate it! Remember to use [code] or [php] tags.
Reply With Quote
